4ef28b4a773dd98ed32c4705437933de1eb0ce91cc43f0068a4581f5d030d677 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 06:02

Sharing

Report Analysis Logs

General

Target

1093b3687c0d1f744a6baad003116341.exe
Size

133KB
MD5

1093b3687c0d1f744a6baad003116341
SHA1

72e1ba7014c9b957dc6ee5f4ee4c1da09bdd77f0
SHA256

4ef28b4a773dd98ed32c4705437933de1eb0ce91cc43f0068a4581f5d030d677
SHA512

5d84e899f095d227acbffc7d3a447024c1d069ff8198f5aa2c2cc349e3fb591e0483c47a440756b8a4127e77dd72d7d0e5bc42ba199f4dfe5ff28e2874ecb5a0
SSDEEP

3072:++FDzK71QkbstyJjCKICpC72s/mlaXZciCi:++I713bstyJj0sC7/H

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
624	1664	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 624	1664	1093b3687c0d1f744a6baad003116341.exe	14
PID 1664 wrote to memory of 624	1664	1093b3687c0d1f744a6baad003116341.exe	14
PID 1664 wrote to memory of 624	1664	1093b3687c0d1f744a6baad003116341.exe	14
PID 1664 wrote to memory of 624	1664	1093b3687c0d1f744a6baad003116341.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 128
1⤵
- Program crash
PID:624

C:\Users\Admin\AppData\Local\Temp\1093b3687c0d1f744a6baad003116341.exe
"C:\Users\Admin\AppData\Local\Temp\1093b3687c0d1f744a6baad003116341.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download